Hacker News new | ask | show | jobs
by AegirLeet 707 days ago
Turns out ads aren't just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web.

In other words: If you're trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBlock Origin for them.

4 comments

It's to the point that even the US government (even with all its faults and lobbying) recommends using an ad blocker for this reason.
Very interesting! Could you link to that recommendation?
Why isn't there any market fulfillment for "safe, non-intrusive ads", on the part of a vendor? Is it because it's not possible, or not worth the overhead either because of cost or no effect on consumer behavior/blocking?

This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.

I feel like this was one of the original selling points of Google's ads. They were pretty simple, unobtrusive, mostly text, ads.
The doubleclick acquisition was the end of that.
Isn't that when the business majors took over?
> I feel like this was one of the original selling points of Google's ads. They were pretty simple, unobtrusive, mostly text, ads.

One of the original factors in the rapid uptake of Chrome was believed to be that the ads for it were the first time an ad appeared on google.com.

There were ads on google.com since at least 2000[1]. Chrome wasn't announced until 2008. Disclosure: I work at Google but not on ads or Chrome.

[1] https://googlepress.blogspot.com/2000/10/google-launches-sel...

I believe they meant on https://google.com (the home page)
Oh, I didn't think of that. But I don't think that's really true either. There seem to be ads on the homepage before Chrome:

Google News: https://web.archive.org/web/20021001073516/http://www.google...

Google Calendar: https://web.archive.org/web/20060831050142/http://www.google...

For comparison, Chrome: https://web.archive.org/web/20080904192205/http://www.google...

Now admittedly the Chrome one is a bit flashier. Although I haven't exhaustively gone through every homepage variant before Chrome, so it's possible there was something as flashy before Chrome as well.

Yes, thank you, you are right!
Intrusive ads are more profitable for the ad company, while the costs are largely born by other parties. A strategy to privatize the gains and socialize the costs is common in a lot of sleazy industries.
There is zero reason for ad companies or ad networks to be covered by any safe harbor provisions of the law. They should have 100% criminal liability for every mal-advertisement they send to a user.
Ads are a paid transaction and Ad Companies absolutely need to be held liable for the money that they take because of who they take it from voluntarily. Google should be ashamed at all the money they are making from scammers and criminals and other evils. They should have a terrible score at every agency remotely like the Better Business Bureau. They should be tarred and feathered in public opinion. The brand name should already be tarnished by all this Evil across too many years of negligence. Same goes for Meta/Facebook, though they do have some of the tarnish already, more than Google has managed to get to stick. (I think too many people still want to believe the "Do No Evil" lie and its lasting brand propaganda.) Other companies should be wary of working with Google because of that bad reputation. ("No, we won't be using GCP because Google does too much business with criminals.")

Yes, it is hard to scale Terms of Service enforcement. Yes it is a hard problem to solve finding bad actors at scale. That shouldn't be a free pass to just not do it at all. Especially when money is changing hands. If someone is paying you to be a bad actor they are either paying you to look the other way (called a "bribe" in most jurisdictions, and illegal in some of them) or you aren't doing due diligence before accepting bad money (called things like "laundering" and "embezzlement" at scale). "It's hard to scale" doesn't sound like a good excuse to do financial crimes, last I checked with banking regulators and is in fact the opposite (a larger crime); why should Google or Meta get a free pass in advertising because they don't want to put the work in and take the revenue hit?

> Yes, it is hard to scale Terms of Service enforcement. Yes it is a hard problem to solve finding bad actors at scale. That shouldn't be a free pass to just not do it at all.

What evidence do you have that they are "not doing it at all"?

> Google should be ashamed at all the money they are making from scammers and criminals and other evils.

Yes, and so should every person that works for them.

> Google should be ashamed

"Do no evil. Instead enable others to do evil profitably and take a cut off the top."

They don't. DMCA safe-harbor covers copyright violations. All it takes is a prosecutor willing to use the CFAA to hold business as accountable as people.
> DMCA safe-harbor covers copyright violations.

That's true, but Section 230 of the Communications Decency Act of 1996 provides broader (but not unlimited) immunity for user submitted content.

It doesn't seem to be profitable, in part because the internet now consists of mega-sites and if your network doesn't serve ads on the mega-sites, no one is interested in your network.

Project Wonderful was a fantastic webcomic-focused ad network. From my perspective as a reader, being shown ads for other webcomics while I'm reading a webcomic was... a positive, really. A lot of webcomic artists ran Project Wonderful ads and nothing else. They shut down in part because of the rise of facebook.

They are rare but do exist, see ethicalads and Modrinth’s ad program
They are still third-party ad networks that require a browser to cross multiple domains, etc. etc. etc.

I am not ideologically opposed to advertisements but I do believe the only safe ads are first party hosted coming from the same domain.

most people publishing a website either cannot or do not care to host the ad server on the same domain, they just want to monetize the site.

things could get a lot better, but this self hosting suggestion in particular will never see wide adoption unless major hosting providers build it and host for their customers. most people don't even bother to self-host/bundle stuff like their fonts and JS libraries unless they have have a JS framework in the loop doing it for them.

Pack before the web most places doing ads had them al, in house, salesmen (mostly male) design and so on., large byers (mcdonalds) might hire an agency to talk to all the little newspapers, but even the little ones did this in house.
> most people publishing a website either cannot or do not care to host the ad server on the same domain, they just want to monetize the site.

That's sort of beside the point, though. The site owner's commitment to running ads is useless unless there are people to view them, and, as long as unsafe ads are ubiquitous, the only safe advice to give to people is that they should run ad blockers everywhere. It doesn't matter that that isn't what the site owner wants to happen.

there are plenty of site owners that would voluntarily choose a more ethical ad hosting network if it was a good and easy option.

adding a pain-in-the-ass hurdle like "has to be hosted on the same domain" that 99.99% of people won't see the value of or understand is only going to hurt adoption of the better solutions.

Who said anything about an ad server ?

An ad is a particularly sized JPEG that you place in your images directories… and then point to with an HTML tag.

Everything we tried to build for you was lost once you deviated from that level of complexity.

one suggestion more arrogant, ridiculous, and in bad faith than the last

you're now implying everyone hosting a website should pound the pavement to sell their own ads - or use a a static export from an ad network and build it into the website themselves? Sure maybe they should but they never will. Dream on.

> Everything we tried to build for you

You are a speck of dust in the universe of computing. Get a grip.

Modrinth’s ads are this way.
Google’s search ads have become explicitly more intrusive and less distinguishable from the real content over time, deliberately and knowingly.

It’s funny, that while many parts of Google are making improvements to the web security ecosystem, they are completely ready to throw it out of the window when it comes to making them more money.

You mean you can’t see the “promoted content” label that is 1 px high?
TIP: I sold my senior mom on uBlock Origin because YT ads are so obnoxious. The added benefits are extra security and performance improvements. She was even able to understand that if something doesn't seem to be working right (like a banking site) "turn it off and try again".
And at the same time ads are the reason we can use many services for free.